1503202 - Firefox constantly ask me to reconnect to sync

Status: RESOLVED DUPLICATE of bug 1219219

(Firefox :: Sync, defect)

Description

[PierU]

Attachment: error-sync-1540893286046.txt

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:60.0) Gecko/20100101 Firefox/60.0

Steps to reproduce:

I did nothing that I can notice, and sync stopped working on one of my machines (Windows 7, FF 60.0.2 ESR). It asks me constantly to "Reconnect to Sync" : I do so, I enter my credentials, I have the tab "Sign-in confirmed - Success - You are now ready to use Firefox Sync", and then after a few seconds the message "Reconnect to Sync" comes back (and nothing sync-ed).

I tried to remove/reinstall FF, to reset the profile, but this didn't solve the issue.

I attach the latest sync log

Regards,

Comment 1

[Ryan Kelly [:rfkelly]]

Thanks for the report!  I see a lot of things in the logs that look like proxy redirects of some sort:

```
1540892681912	Services.Common.RESTRequest	TRACE	onStartRequest: GET https://profile.accounts.firefox.com/v1/profile?_sm_byp=iVVqVn1sSVv17DQr
1540892681912	Services.Common.RESTRequest	TRACE	Channel for GET https://profile.accounts.firefox.com/v1/profile?_sm_byp=iVVqVn1sSVv17DQr returned status code 0
1540892681913	Services.Common.RESTRequest	DEBUG	GET https://profile.accounts.firefox.com/v1/profile?_sm_byp=iVVqVn1sSVv17DQr 401
1540892681913	Services.Common.RESTRequest	TRACE	GET body: {"code":401,"errno":100,"error":"Bad Request","message":"Unauthorized","reason":"Bearer token not provided"}
```

```
1540893285499	Services.Common.RESTRequest	DEBUG	Channel redirect: https://token.services.mozilla.com/1.0/sync/1.5, https://gateway.zscaler.net/auD?origurl=https%3A%2F%2Ftoken%2eservices%2emozilla%2ecom%2f1%2e0%2fsync%2f1%2e5&_ordtok=M5k3WVRWFBbb6JDJ9NSHQS5JMM, 1
1540893285499	Services.Common.RESTRequest	DEBUG	Channel redirect: https://token.services.mozilla.com/1.0/sync/1.5, https://gateway.zscaler.net/auD?origurl=https%3A%2F%2Ftoken%2eservices%2emozilla%2ecom%2f1%2e0%2fsync%2f1%2e5&_ordtok=M5k3WVRWFBbb6JDJ9NSHQS5JMM, internal = false
1540893285612	Services.Common.RESTRequest	DEBUG	Channel redirect: https://gateway.zscaler.net/auD?origurl=https%3A%2F%2Ftoken%2eservices%2emozilla%2ecom%2f1%2e0%2fsync%2f1%2e5&_ordtok=M5k3WVRWFBbb6JDJ9NSHQS5JMM, https://gateway.zscaler.net/auT?origurl=https%3A%2F%2Ftoken%2eservices%2emozilla%2ecom%2f1%2e0%2fsync%2f1%2e5&_ordtok=M5k3WVRWFBbb6JDJ9NSHQS5JMM, 1
1540893285613	Services.Common.RESTRequest	DEBUG	Channel redirect: https://gateway.zscaler.net/auD?origurl=https%3A%2F%2Ftoken%2eservices%2emozilla%2ecom%2f1%2e0%2fsync%2f1%2e5&_ordtok=M5k3WVRWFBbb6JDJ9NSHQS5JMM, https://gateway.zscaler.net/auT?origurl=https%3A%2F%2Ftoken%2eservices%2emozilla%2ecom%2f1%2e0%2fsync%2f1%2e5&_ordtok=M5k3WVRWFBbb6JDJ9NSHQS5JMM, internal = false
1540893285730	Services.Common.RESTRequest	DEBUG	Channel redirect: https://gateway.zscaler.net/auT?origurl=https%3A%2F%2Ftoken%2eservices%2emozilla%2ecom%2f1%2e0%2fsync%2f1%2e5&_ordtok=M5k3WVRWFBbb6JDJ9NSHQS5JMM, https://token.services.mozilla.com/1.0/sync/1.5?_sm_byp=iVVqVn1sSVv17DQr, 1
1540893285730	Services.Common.RESTRequest	DEBUG	Channel redirect: https://gateway.zscaler.net/auT?origurl=https%3A%2F%2Ftoken%2eservices%2emozilla%2ecom%2f1%2e0%2fsync%2f1%2e5&_ordtok=M5k3WVRWFBbb6JDJ9NSHQS5JMM, https://token.services.mozilla.com/1.0/sync/1.5?_sm_byp=iVVqVn1sSVv17DQr, internal = false
1540893286023	Services.Common.RESTRequest	TRACE	onStartRequest: GET https://token.services.mozilla.com/1.0/sync/1.5?_sm_byp=iVVqVn1sSVv17DQr
1540893286023	Services.Common.RESTRequest	TRACE	Channel for GET https://token.services.mozilla.com/1.0/sync/1.5?_sm_byp=iVVqVn1sSVv17DQr returned status code 0
1540893286023	Services.Common.RESTRequest	DEBUG	GET https://token.services.mozilla.com/1.0/sync/1.5?_sm_byp=iVVqVn1sSVv17DQr 401
1540893286023	Services.Common.RESTRequest	TRACE	GET body: {"status": "error", "errors": [{"location": "body", "name": "", "description": "Unauthorized"}]}
1540893286023	Services.Common.TokenServerClient	DEBUG	Got token response: 401
```

Either of these 401s could be causing Firefox to disconnect from sync, perhaps the Authorization header is not surviving redirects properly.  ni? myself to dig into this more...

Comment 2

[Ryan Kelly [:rfkelly]]

So, best I can tell you're using this machine behind a "zscaler" security proxy, which is using HTTP redirects to try to intercept sync's network requests.  The sync client code follows the redirects but (correctly) does not forward the "Authorization" header when doing so.  This results in a "401 Unauthorized" error being returned from the sync servers, which makes Firefox think that your signin has been revoked and triggers the "Reconnect to Sync" message.

Is this zscaler setup something that changed recently for your machine?

Comment 3

[PierU]

Thanks for the answer.

Indeed I use this machine behind the "zscaler" security proxy of the company where I work. As far as I know the zscaler configuration didn't change recently. Moreover I use FF on another Windows 7 machine on the same network, and sync was still working OK today.

That said, the machine on which sync does no longer work is a laptop: tomorrow evening I will take it at home and test it without the proxy.

Comment 4

[Mark Hammond [:markh] [:mhammond]]

Bug 1219219 has some discussion (but no resolution) around using zscaler

Comment 5

[PierU]

Well, I said that sync was working properly on another machine on the same network, but actually I was wrong : it silently stopped sync-ing 10 days ago. It wasn't asking me to reconnect, but he was simply no longer sync-ing (with error logs). And now (this morning) it constantly asks me to reconnect, like on the other machine.

So very probably there has been some changes related to zscaler about 10 days ago, which impacts sync. At that time I remember that our IT service told us to install a new certificate...

Comment 6

[PierU]

As expected Sync is working correctly as soon as the machine is not behind the proxy... which doesn't solve the problem, since I also use a desktop PC that I can't move...

Comment 7

[Mark Hammond [:markh] [:mhammond]]

Thanks for getting back to us - bug 1219219 has more detail on zscaler, so I'll close this as a dupe of that.